Go to packages list

nuxt-webpack-builder

Ecosystem: npm

Downloads: 9.36 K

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 0HighAffects 0 versions
  • 0MediumAffects 0 versions
  • 3ModerateAffects 5 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High0 (0.0%)
  • Medium0 (0.0%)
  • Moderate3 (100.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting nuxt-webpack-builder, based on data from OSV.

Vulnerabilities affecting nuxt-webpack-builder
IDSeveritySummaryAffected versionsPublishedSource
GHSA-x6qj-4h56-5rj5Moderate@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)### Summary This is an incomplete fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g). Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. `nuxt dev --host`) and the developer opens a malicious site on the same network. ### Details The fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g) added an `Origin` / `Referer` fallback to the dev-middleware same-origin check, with a `return true` branch when neither head
  • >= 4.0.0, < 4.4.7
  • >= 3.15.4, < 3.21.7
GitHub (opens in a new tab)
GHSA-6m52-m754-pw2gModerateNuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)### Summary This is an incomplete fix for [GHSA-4gf7-ff8x-hq99](https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99). Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. `nuxt dev --host`) and the developer opens a malicious site on the same network. ### Details The fix for [GHSA-4gf7-ff8x-hq99](https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99) relied on Sec-Fetch-Mode and Sec-Fetch-Site headers. Because [these headers are sent by the browsers only for potentially trustwort
  • >= 3.15.4, < 3.21.6
  • >= 4.0.0-alpha.1, < 4.4.6
GitHub (opens in a new tab)
GHSA-4gf7-ff8x-hq99ModerateOpening a malicious website while running a Nuxt dev server could allow read-only access to code### Summary Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site. ### Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject `<script src="http://localhost:3000/_nuxt/app.js">` in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. ### PoC 1. Create a nuxt project with webpack / rspack builder. 1. Run `npm run dev` 1. Open `http://localhost:3000` 1. Run the script below in
  • >= 3.0.0, < 3.15.3
GitHub (opens in a new tab)
  • GHSA-x6qj-4h56-5rj5Moderate
    @nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)
    • >= 4.0.0, < 4.4.7
    • >= 3.15.4, < 3.21.7
    GitHub (opens in a new tab)

    ### Summary This is an incomplete fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g). Source code may still be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. `nuxt dev --host`) and the developer opens a malicious site on the same network. ### Details The fix for [GHSA-6m52-m754-pw2g](https://github.com/nuxt/nuxt/security/advisories/GHSA-6m52-m754-pw2g) added an `Origin` / `Referer` fallback to the dev-middleware same-origin check, with a `return true` branch when neither head

    CVE: CVE-2026-49993

  • GHSA-6m52-m754-pw2gModerate
    Nuxt: Dev server exposes built source over LAN to malicious sites (incomplete fix for GHSA-4gf7-ff8x-hq99)
    • >= 3.15.4, < 3.21.6
    • >= 4.0.0-alpha.1, < 4.4.6
    GitHub (opens in a new tab)

    ### Summary This is an incomplete fix for [GHSA-4gf7-ff8x-hq99](https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99). Source code may be stolen during dev when using the webpack / rspack builder if the dev server is bound to a non-loopback address (e.g. `nuxt dev --host`) and the developer opens a malicious site on the same network. ### Details The fix for [GHSA-4gf7-ff8x-hq99](https://github.com/nuxt/nuxt/security/advisories/GHSA-4gf7-ff8x-hq99) relied on Sec-Fetch-Mode and Sec-Fetch-Site headers. Because [these headers are sent by the browsers only for potentially trustwort

    CVE: CVE-2026-45670

  • GHSA-4gf7-ff8x-hq99Moderate
    Opening a malicious website while running a Nuxt dev server could allow read-only access to code
    • >= 3.0.0, < 3.15.3
    GitHub (opens in a new tab)

    ### Summary Source code may be stolen during dev when using webpack / rspack builder and you open a malicious web site. ### Details Because the request for classic script by a script tag is not subject to same origin policy, an attacker can inject `<script src="http://localhost:3000/_nuxt/app.js">` in their site and run the script. By using `Function::toString` against the values in `window.webpackChunknuxt_app`, the attacker can get the source code. ### PoC 1. Create a nuxt project with webpack / rspack builder. 1. Run `npm run dev` 1. Open `http://localhost:3000` 1. Run the script below in

    CVE: CVE-2025-24361

Showing 1-3 of 3 vulnerabilities